Monthly Archives: September 2026

WordPress 7.1.2 Release

Posted on

This security release features a fix for a critical severity security vulnerability.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. [All applicable clients of ProtectYourWP.com have already been updated.] If you have sites that support automatic background updates, the update process will begin automatically.

Security update included in this release

The security team would like to thank Robert Ressl for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE).

Source: https://wordpress.org/news/2026/09/wordpress-7-1-2-release/

WordPress Patches ‘Click2Shell’ Vulnerability

Posted on

The bug lets attackers automatically install and preview themes and could lead to remote code execution.

WordPress last week released patches for 11 vulnerabilities, including a flaw that could potentially lead to remote code execution (RCE).

Dubbed Click2Shell, the flaw does not have a CVE identifier yet. In its advisory, WordPress explains that it could be exploited via specially crafted URLs to automatically install and preview inactive themes.

While this may sound relatively harmless, it is not: the inactive theme can be leveraged for RCE, according to pwn.ai, which was credited with finding and reporting the bug.

The issue, it explains, exists because a value in the WordPress theme-preview URL is interpreted differently by the themes API and by the JavaScript running in an administrator’s browser.

“The API reduces the value to an ordinary theme slug. The browser retains the original punctuation and places it inside a jQuery selector,” pwn.ai explains.

This allows an unauthenticated attacker to force the installation of an attacker-selected theme on the administrator’s site. The theme is fetched from the official WordPress.org catalog without the administrator’s knowledge or consent.

While the theme is inactive and should not pose a threat, pwn.ai discovered that there are over 40 third-party themes on WordPress that could be abused for PHP code execution while inactive.

Because WordPress loads their PHP code during Customizer preview even if another theme is active, an attacker could abuse their unprotected installers to point to a crafted plugin package that could be executed under the WordPress server account.

“No attacker WordPress account is needed. Just a single visit from a logged-in user and the attacker owns the site,” pwn.ai explains. The company has published technical details and proof-of-concept (PoC) code targeting the flaw.

Another important issue, pwn.ai says, is the fact that an administrator might not notice the abnormal behavior, given that the site’s main theme remains active during the exploit.

WordPress patched Click2Shell and the remaining 10 vulnerabilities in version 7.1.1 of the content management system and paid pwn.ai a $300 reward, its maximum bug bounty amount.

Fixes for the security defects were also included updates for older WordPress iterations, all the way back to WordPress 4.7.

Source: https://www.securityweek.com/wordpress-patches-click2shell-vulnerability/

WordPress 7.1.1 Maintenance and Security Release

Posted on

This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. [All applicable client sites of ProtectYourWP.com have already been updated.] If you have sites that support automatic background updates, the update process will begin automatically.

WordPress 7.1.1 is a short-cycle release. The next major release will be version 7.2 and is currently planned for December.

For more information, please visit the WordPress 7.1.1 HelpHub site.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

  • Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
  • HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
  • Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
  • Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
  • Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
  • Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
  • XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
  • Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
  • Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
  • Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by Jakub Herman.
  • Comments, including notes, can be reparented by any authenticated user, reported by Justin Hart, Viridis Security.

Source: https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/